su.c revision 1.26
1 /* $NetBSD: su.c,v 1.26 1998/08/25 20:59:40 ross Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include <sys/cdefs.h> 37 #ifndef lint 38 __COPYRIGHT( 39 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 40 All rights reserved.\n"); 41 #endif /* not lint */ 42 43 #ifndef lint 44 #if 0 45 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 46 #else 47 __RCSID("$NetBSD: su.c,v 1.26 1998/08/25 20:59:40 ross Exp $"); 48 #endif 49 #endif /* not lint */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 #include <sys/resource.h> 54 #include <err.h> 55 #include <errno.h> 56 #include <grp.h> 57 #include <paths.h> 58 #include <pwd.h> 59 #include <stdio.h> 60 #include <skey.h> 61 #include <stdlib.h> 62 #include <string.h> 63 #include <syslog.h> 64 #include <time.h> 65 #include <tzfile.h> 66 #include <unistd.h> 67 68 #ifdef KERBEROS 69 #include <kerberosIV/des.h> 70 #include <kerberosIV/krb.h> 71 #include <netdb.h> 72 73 #define ARGSTR "-Kflm" 74 75 int use_kerberos = 1; 76 77 static int kerberos __P((char *, char *, int)); 78 static int koktologin __P((char *, char *, char *)); 79 80 #else 81 #define ARGSTR "-flm" 82 #endif 83 84 #ifndef SUGROUP 85 #define SUGROUP "wheel" 86 #endif 87 88 89 int main __P((int, char **)); 90 91 static int chshell __P((const char *)); 92 static char *ontty __P((void)); 93 94 95 int 96 main(argc, argv) 97 int argc; 98 char **argv; 99 { 100 extern char *__progname; 101 extern char **environ; 102 struct passwd *pwd; 103 char *p; 104 struct group *gr; 105 struct timeval tp; 106 uid_t ruid; 107 int asme, ch, asthem, fastlogin, prio; 108 enum { UNSET, YES, NO } iscsh = UNSET; 109 char *user, *shell, *avshell, *username, *cleanenv[10], **np; 110 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 111 112 asme = asthem = fastlogin = 0; 113 shell = NULL; 114 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 115 switch((char)ch) { 116 #ifdef KERBEROS 117 case 'K': 118 use_kerberos = 0; 119 break; 120 #endif 121 case 'f': 122 fastlogin = 1; 123 break; 124 case '-': 125 case 'l': 126 asme = 0; 127 asthem = 1; 128 break; 129 case 'm': 130 asme = 1; 131 asthem = 0; 132 break; 133 case '?': 134 default: 135 (void)fprintf(stderr, 136 "Usage: %s [%s] [login [shell arguments]]\n", 137 __progname, ARGSTR); 138 exit(1); 139 } 140 argv += optind; 141 142 errno = 0; 143 prio = getpriority(PRIO_PROCESS, 0); 144 if (errno) 145 prio = 0; 146 (void)setpriority(PRIO_PROCESS, 0, -2); 147 openlog("su", LOG_CONS, 0); 148 149 /* get current login name and shell */ 150 ruid = getuid(); 151 username = getlogin(); 152 if (username == NULL || (pwd = getpwnam(username)) == NULL || 153 pwd->pw_uid != ruid) 154 pwd = getpwuid(ruid); 155 if (pwd == NULL) 156 errx(1, "who are you?"); 157 username = strdup(pwd->pw_name); 158 if (username == NULL) 159 err(1, "strdup"); 160 161 if (asme) { 162 if (pwd->pw_shell && *pwd->pw_shell) { 163 shell = strncpy(shellbuf, pwd->pw_shell, 164 sizeof(shellbuf) - 1); 165 shellbuf[sizeof(shellbuf) - 1] = '\0'; 166 } else { 167 shell = _PATH_BSHELL; 168 iscsh = NO; 169 } 170 } 171 /* get target login information, default to root */ 172 user = *argv ? *argv : "root"; 173 np = *argv ? argv : argv-1; 174 175 if ((pwd = getpwnam(user)) == NULL) 176 errx(1, "unknown login %s", user); 177 178 if (ruid 179 #ifdef KERBEROS 180 && (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 181 #endif 182 ) { 183 /* 184 * Only allow those in group SUGROUP to su to root, 185 * but only if that group has any members. 186 * If SUGROUP has no members, allow anyone to su root 187 */ 188 if (pwd->pw_uid == 0 && 189 (gr = getgrnam(SUGROUP)) && *gr->gr_mem) { 190 char **g; 191 192 for (g = gr->gr_mem; ; g++) { 193 if (*g == NULL) 194 errx(1, 195 "you are not listed in the correct secondary group (%s) to su %s.", 196 SUGROUP, user); 197 if (strcmp(username, *g) == 0) 198 break; 199 } 200 } 201 /* if target requires a password, verify it */ 202 if (*pwd->pw_passwd) { 203 p = getpass("Password:"); 204 #ifdef SKEY 205 if (strcasecmp(p, "s/key") == 0) { 206 if (skey_haskey(user)) 207 errx(1, "Sorry, you have no s/key."); 208 else { 209 if (skey_authenticate(user)) { 210 goto badlogin; 211 } 212 } 213 214 } else 215 #endif 216 if (strcmp(pwd->pw_passwd, crypt(p, pwd->pw_passwd))) { 217 badlogin: 218 fprintf(stderr, "Sorry\n"); 219 syslog(LOG_AUTH|LOG_WARNING, 220 "BAD SU %s to %s%s", username, 221 user, ontty()); 222 exit(1); 223 } 224 } 225 } 226 227 if (asme) { 228 /* if asme and non-standard target shell, must be root */ 229 if (!chshell(pwd->pw_shell) && ruid) 230 errx(1,"permission denied (shell)."); 231 } else if (pwd->pw_shell && *pwd->pw_shell) { 232 shell = pwd->pw_shell; 233 iscsh = UNSET; 234 } else { 235 shell = _PATH_BSHELL; 236 iscsh = NO; 237 } 238 239 if ((p = strrchr(shell, '/')) != NULL) 240 avshell = p+1; 241 else 242 avshell = shell; 243 244 /* if we're forking a csh, we want to slightly muck the args */ 245 if (iscsh == UNSET) 246 iscsh = strstr(avshell, "csh") ? YES : NO; 247 248 /* set permissions */ 249 if (setgid(pwd->pw_gid) < 0) 250 err(1, "setgid"); 251 if (initgroups(user, pwd->pw_gid)) 252 errx(1, "initgroups failed"); 253 if (setuid(pwd->pw_uid) < 0) 254 err(1, "setuid"); 255 256 if (!asme) { 257 if (asthem) { 258 p = getenv("TERM"); 259 cleanenv[0] = NULL; 260 environ = cleanenv; 261 (void)setenv("PATH", _PATH_DEFPATH, 1); 262 if (p) 263 (void)setenv("TERM", p, 1); 264 if (chdir(pwd->pw_dir) < 0) 265 errx(1, "no directory"); 266 } 267 if (asthem || pwd->pw_uid) 268 (void)setenv("USER", pwd->pw_name, 1); 269 (void)setenv("HOME", pwd->pw_dir, 1); 270 (void)setenv("SHELL", shell, 1); 271 } 272 273 if (iscsh == YES) { 274 if (fastlogin) 275 *np-- = "-f"; 276 if (asme) 277 *np-- = "-m"; 278 } 279 280 if (asthem) { 281 avshellbuf[0] = '-'; 282 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 283 avshell = avshellbuf; 284 } else if (iscsh == YES) { 285 /* csh strips the first character... */ 286 avshellbuf[0] = '_'; 287 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 288 avshell = avshellbuf; 289 } 290 *np = avshell; 291 292 if (pwd->pw_change || pwd->pw_expire) 293 (void)gettimeofday(&tp, (struct timezone *)NULL); 294 if (pwd->pw_change) { 295 if (tp.tv_sec >= pwd->pw_change) { 296 (void)printf("%s -- %s's password has expired.\n", 297 (ruid ? "Sorry" : "Note"), user); 298 if (ruid != 0) 299 exit(1); 300 } else if (pwd->pw_change - tp.tv_sec < 301 _PASSWORD_WARNDAYS * SECSPERDAY) 302 (void)printf("Warning: %s's password expires on %s", 303 user, ctime(&pwd->pw_change)); 304 } 305 if (pwd->pw_expire) { 306 if (tp.tv_sec >= pwd->pw_expire) { 307 (void)printf("%s -- %s's account has expired.\n", 308 (ruid ? "Sorry" : "Note"), user); 309 if (ruid != 0) 310 exit(1); 311 } else if (pwd->pw_expire - tp.tv_sec < 312 _PASSWORD_WARNDAYS * SECSPERDAY) 313 (void)printf("Warning: %s's account expires on %s", 314 user, ctime(&pwd->pw_expire)); 315 } 316 if (ruid != 0) 317 syslog(LOG_NOTICE|LOG_AUTH, "%s to %s%s", 318 username, user, ontty()); 319 320 (void)setpriority(PRIO_PROCESS, 0, prio); 321 322 execv(shell, np); 323 err(1, "%s", shell); 324 } 325 326 static int 327 chshell(sh) 328 const char *sh; 329 { 330 const char *cp; 331 332 while ((cp = getusershell()) != NULL) 333 if (!strcmp(cp, sh)) 334 return (1); 335 return (0); 336 } 337 338 static char * 339 ontty() 340 { 341 char *p; 342 static char buf[MAXPATHLEN + 4]; 343 344 buf[0] = 0; 345 if ((p = ttyname(STDERR_FILENO)) != NULL) 346 (void)snprintf(buf, sizeof buf, " on %s", p); 347 return (buf); 348 } 349 350 #ifdef KERBEROS 351 static int 352 kerberos(username, user, uid) 353 char *username, *user; 354 int uid; 355 { 356 KTEXT_ST ticket; 357 AUTH_DAT authdata; 358 struct hostent *hp; 359 int kerno; 360 u_long faddr; 361 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 362 char hostname[MAXHOSTNAMELEN + 1], savehost[MAXHOSTNAMELEN + 1]; 363 364 if (krb_get_lrealm(lrealm, 1) != KSUCCESS) 365 return (1); 366 if (koktologin(username, lrealm, user) && !uid) { 367 warnx("kerberos: not in %s's ACL.", user); 368 return (1); 369 } 370 (void)(void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 371 user, getuid()); 372 373 (void)setenv("KRBTKFILE", krbtkfile, 1); 374 (void)krb_set_tkt_string(krbtkfile); 375 /* 376 * Set real as well as effective ID to 0 for the moment, 377 * to make the kerberos library do the right thing. 378 */ 379 if (setuid(0) < 0) { 380 warn("setuid"); 381 return (1); 382 } 383 384 /* 385 * Little trick here -- if we are su'ing to root, 386 * we need to get a ticket for "xxx.root", where xxx represents 387 * the name of the person su'ing. Otherwise (non-root case), 388 * we need to get a ticket for "yyy.", where yyy represents 389 * the name of the person being su'd to, and the instance is null 390 * 391 * We should have a way to set the ticket lifetime, 392 * with a system default for root. 393 */ 394 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 395 (uid == 0 ? "root" : ""), lrealm, 396 "krbtgt", lrealm, DEFAULT_TKT_LIFE, 0); 397 398 if (kerno != KSUCCESS) { 399 if (kerno == KDC_PR_UNKNOWN) { 400 warnx("kerberos: principal unknown: %s.%s@%s", 401 (uid == 0 ? username : user), 402 (uid == 0 ? "root" : ""), lrealm); 403 return (1); 404 } 405 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 406 syslog(LOG_NOTICE|LOG_AUTH, 407 "BAD Kerberos SU: %s to %s%s: %s", 408 username, user, ontty(), krb_err_txt[kerno]); 409 return (1); 410 } 411 412 if (chown(krbtkfile, uid, -1) < 0) { 413 warn("chown"); 414 (void)unlink(krbtkfile); 415 return (1); 416 } 417 418 (void)setpriority(PRIO_PROCESS, 0, -2); 419 420 if (gethostname(hostname, sizeof(hostname)) == -1) { 421 warn("gethostname"); 422 dest_tkt(); 423 return (1); 424 } 425 hostname[sizeof(hostname) - 1] = '\0'; 426 427 (void)strncpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 428 savehost[sizeof(savehost) - 1] = '\0'; 429 430 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 431 432 if (kerno == KDC_PR_UNKNOWN) { 433 warnx("Warning: TGT not verified."); 434 syslog(LOG_NOTICE|LOG_AUTH, 435 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 436 username, user, ontty(), krb_err_txt[kerno], 437 "rcmd", savehost); 438 } else if (kerno != KSUCCESS) { 439 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 440 syslog(LOG_NOTICE|LOG_AUTH, "failed su: %s to %s%s: %s", 441 username, user, ontty(), krb_err_txt[kerno]); 442 dest_tkt(); 443 return (1); 444 } else { 445 if (!(hp = gethostbyname(hostname))) { 446 warnx("can't get addr of %s", hostname); 447 dest_tkt(); 448 return (1); 449 } 450 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 451 452 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 453 &authdata, "")) != KSUCCESS) { 454 warnx("kerberos: unable to verify rcmd ticket: %s\n", 455 krb_err_txt[kerno]); 456 syslog(LOG_NOTICE|LOG_AUTH, 457 "failed su: %s to %s%s: %s", username, 458 user, ontty(), krb_err_txt[kerno]); 459 dest_tkt(); 460 return (1); 461 } 462 } 463 return (0); 464 } 465 466 static int 467 koktologin(name, realm, toname) 468 char *name, *realm, *toname; 469 { 470 AUTH_DAT *kdata; 471 AUTH_DAT kdata_st; 472 473 kdata = &kdata_st; 474 memset((char *)kdata, 0, sizeof(*kdata)); 475 (void)strncpy(kdata->pname, name, sizeof(kdata->pname) - 1); 476 (void)strncpy(kdata->pinst, 477 ((strcmp(toname, "root") == 0) ? "root" : ""), sizeof(kdata->pinst) - 1); 478 (void)strncpy(kdata->prealm, realm, sizeof(kdata->prealm) - 1); 479 return (kuserok(kdata, toname)); 480 } 481 #endif 482
Indexes created Thu Sep 25 16:09:42 GMT 2025